Anvilogic high experimental other

Keychain Export - MacOS [snowflake-crowdstrikefdr_process]

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. This use case detects commands used to access, dump, or export information from keychains. Atomics T1555.001 Test #1

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Mac') and regexp_like(parent_process_name, '.*zsh
| bash
| sh
| tcsh
| csh
| ksh.*', 'i') and regexp_like(process, '.*security.*', 'i') and (regexp_like(process, '.*find-certificate.*', 'i') or regexp_like(process, '.*(list
| default
| login
| show
| dump)-keychain.*', 'i') or regexp_like(process, '.*export.*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...